# Trust at Anpheros Platform: what we have, what we don't, what's next

> What protects health data on Anpheros Platform today (EU hosting, DPA, encryption, consent, audit), what is missing (no own SOC 2 or ISO 27001 yet, no external penetration test) and what comes next.

Source: https://developers.anpheros.com/guides/trust

**Anpheros is in private beta. This page says plainly what protects the data today, what is missing, and when it comes.**

## What we have
- **EU hosting.** Platform data is stored and processed in the European Union by default (Google Cloud europe-west4, Netherlands; webhook queue in Frankfurt; audit export in the BigQuery EU location). Sub-processors are listed in our data processing agreement.
- **GDPR roles and a DPA.** The clinic or company is the controller; Anpheros is the processor. For data a patient keeps in their own Anpheros app account, Anpheros is the controller. Production keys are issued only to verified organisations with a signed data processing agreement.
- **US customers.** For US production customers we can set up a US data region and sign a HIPAA Business Associate Agreement; Google Cloud's own BAA covers the underlying services.
- **Encryption.** HTTPS only with HSTS; data encrypted at rest by Google Cloud; documents in an EU bucket with a customer-managed encryption key (CMEK), immutable after finalisation, with a SHA-256 checksum.
- **The patient controls access.** Consent per resource type and duration (30–365 days) on a hosted consent page, revocable at once. Revoking stops new access. Records a clinic has already saved in its own system are kept by that clinic under its own legal duties. Every grant is also a FHIR Consent resource.
- **Audit the patient can read.** Every read and write is logged, including reads with a project's own key and context built for AI; the log is hash-chained and exported append-only.
- **Provenance on every write**: who wrote it (patient, practitioner, device, import, AI), for which organisation, from which system.
- **Isolation between applications.** Pairwise identifiers per project; sandbox and production are separate databases, and a test key cannot reach real patients.
- **Credentials.** API keys stored only as hashes; OAuth 2.1 with mandatory PKCE, short-lived rotating tokens with reuse detection; MFA required for organisations with real data.
- **Infrastructure certifications we inherit from Google Cloud** (for the data centres and cloud services, not for Anpheros itself): ISO/IEC 27001, 27017, 27018 and 27701, SOC 1/2/3 reports, CSA STAR. See [Google Cloud's compliance offerings](https://cloud.google.com/security/compliance/offerings).
- **Public availability**: [developers.anpheros.com/status](https://developers.anpheros.com/status), measured every five minutes from outside the service.

## What we don't have (yet)
- **No SOC 2, ISO 27001 or HITRUST certification of our own.** Google's certifications cover the infrastructure, not our company's processes.
- **No database failover across zones.** The service runs across zones; the database runs in one zone with point-in-time recovery and backups stored outside the zone.
- **No contractual SLA with service credits.** Paid plans have a best-effort service level (see the [status page](https://developers.anpheros.com/status): targets, not guarantees, no service credits).
- **No external penetration test yet**; security reviews so far are internal.
- **Private beta**: production opens per verified organisation.

## What's next
These are our plans, not contractual commitments; the order and timing may change.

- With the first paying production customer: a database with automatic failover (high availability).
- When there is revenue: an external penetration test, with a public summary.
- When a hospital or enterprise customer requires it: ISO 27001 (first, for the EU) or SOC 2 Type I, then Type II.
- Continuing: the status page history and published incidents.

## Contact
Security questions and reports: [platform@anpheros.com](mailto:platform@anpheros.com) (privacy: [privacy@anpheros.com](mailto:privacy@anpheros.com)).

## Related

- [Security, privacy and data residency](https://developers.anpheros.com/guides/security)